Server hacked using pam_fprintd.so?

[kalexanakis]

Hello

Yesterday for about 10 minutes no services where working at a cPanel server of mine. Ι immediately investigated the issue and I found out that an attacked managed to have full access to the server as root using sudo! At /var/log/secure :

....
Jun  6 13:21:52 SERVERNAME sshd[13966]: Accepted password for firefart from XXX.XXX.XXX port 28953 ssh2
Jun  6 13:21:52 SERVERNAME sshd[13966]: pam_unix(sshd:session): session opened for user firefart by (uid=0)
...
Jun  6 13:24:25 SERVERNAME su: PAM unable to dlopen(/lib64/security/pam_fprintd.so): /lib64/security/pam_fprintd.so: cannot open shared object file: No such file or directory
Jun  6 13:24:25 SERVERNAME su: PAM adding faulty module: /lib64/security/pam_fprintd.so
Jun  6 13:24:25 SERVERNAME su: pam_unix(su:session): session opened for user root by firefart(uid=0)
...
Jun  6 13:29:13 SERVERNAME sudo: PAM unable to dlopen(/lib64/security/pam_fprintd.so): /lib64/security/pam_fprintd.so: cannot open shared object file: No such file or directory
Jun  6 13:29:13 SERVERNAME sudo: PAM adding faulty module: /lib64/security/pam_fprintd.so
Jun  6 13:29:13 SERVERNAME sudo:     root : TTY=pts/2 ; PWD=/home/HACKEDWEBSITE/public_html/modules/news ; USER=root ; COMMAND=/usr/sbin/useradd -ou 0 -g 0 darkangel
Jun  6 13:29:13 SERVERNAME useradd[23620]: new user: name=darkangel, UID=0, GID=0, home=/home/darkangel, shell=/bin/bash
....
Jun  6 13:32:55 SERVERNAME sudo: PAM unable to dlopen(/lib64/security/pam_fprintd.so): /lib64/security/pam_fprintd.so: cannot open shared object file: No such file or directory
Jun  6 13:32:55 SERVERNAME sudo: PAM adding faulty module: /lib64/security/pam_fprintd.so
Jun  6 13:32:55 SERVERNAME sudo:     root : TTY=pts/1 ; PWD=/root ; USER=root ; COMMAND=/bin/cat /home/HACKEDWEBSITE/public_html/modules/news/
....
Jun  6 13:36:54 SERVERNAME sudo: PAM unable to dlopen(/lib64/security/pam_fprintd.so): /lib64/security/pam_fprintd.so: cannot open shared object file: No such file or directory
Jun  6 13:36:54 SERVERNAME sudo: PAM adding faulty module: /lib64/security/pam_fprintd.so
Jun  6 13:36:54 SERVERNAME sudo:     root : TTY=pts/1 ; PWD=/root ; USER=root ; COMMAND=/bin/rm /root/.bash_history
...

It seems that the attacker managed to create a user called "firefart", which he used to create a super-user "darkangel". Please note that HACKEDWEBSITE had no shell access checked at its account (none cPanel account has). Of course at the end the attacker cleared bash history for root.

Server specs:
- CENTOS 6.9 x86_64 standard
- cPanel & WHM 64.0 (build 24)

Has anybody an idea on how this may have happened?

 

[Infopro]

Kernel up to date? Google for the name firefart.

If you're unsure on what to do next, you should probably hire a qualified SysAdmin to help you.

 

[quizknows]

Most likely a kernel exploit if your kernel is not up to date. Even if a cpanel account has no shell access, you can still run shell commands as the user ID through a hacked PHP web application. A hacked web app should be considered to have the same privileges as a user connecting on SSH (of course jailed vhosts and stuff can effect this, but for the most part, php running as the user has the same privileges as a linux user at the shell).

 

[kalexanakis]

Bad news: I though I got away with it after suspending offending account and updating kernel to latest version.

I managed to login to the server as root and I saw that hacker managed to empty /var/log folder!
Also, I cannot write files to /var/log folder as root making services incapable to start.

Permittions of the folder are fine:
drwxr-xr-x 8 root root 4096 Jun 23 19:35 log/

How root can regain access to /var/log folder?

 

[Jcats]

Your server is rooted, I wouldn't try and take it back, just reinstall the OS and restore backups.

 

[kalexanakis]

Your server is rooted, I wouldn't try and take it back, just reinstall the OS and restore backups.

Thanks mate. I have already started transferring accounts elsewhere, however I just need to know how root will be able to write at /var/log again. Root has already access permittions to manu other folders

 

[Jcats]

Can you paste some of the actual errors that refer to writing to /var/log

 

[kalexanakis]

Can you paste some of the actual errors that refer to writing to /var/log

for example
touch maillog
or
sudo touch maillog
in /var/log folder as root and i get
permission denied

 

[Jcats]

ah can you show output of

grep root /etc/passwd